ISO 21384 Certification in Malaysia – UAS Requirements, CAAM Compliance, Audit & Get Certified with SCS
SCS Certification – Malaysia Office
SCS Certification
Jalan Pinang
50450 Kuala Lumpur
Malaysia
Phone: +60 11 6263 6611
Enquiry: Contact SCS Certification
https://scscertification.com/contactus.php
Commercial drone use in Malaysia has moved well beyond photography. UAS are now used for construction surveys, infrastructure inspection, plantation management, mapping, telecommunications, engineering projects and asset monitoring.
As the number and complexity of these operations grow, companies need a reliable way to control how flights are planned, approved and carried out. A capable aircraft and an experienced pilot are only part of the picture. Businesses also need defined responsibilities, risk assessments, equipment controls, competent personnel, emergency procedures and records that show how operations are managed.
ISO 21384-3:2026 provides an international framework for safe commercial UAS operations. For Malaysian businesses, it can provide a structured basis for managing commercial drone activities and demonstrating that operational controls have been established and implemented.
There is one distinction that should be made from the beginning: ISO 21384 certification is not the same as permission to fly a UAS in Malaysia. CAAM authorization and other applicable Malaysian requirements remain separate matters.
What Is ISO 21384 Certification in Malaysia?
ISO 21384 is a family of standards concerned with unmanned aircraft systems. ISO 21384-3:2026 focuses on operational procedures for safe commercial UAS operations.
For a Malaysian organization, certification involves an independent assessment of the organization's applicable UAS operational controls against the requirements within the agreed certification scope.
The scope should describe what the organization actually does. A company providing drone inspection services, for example, should not use a generic scope that gives no indication of the nature of its commercial activities.
Depending on the business, the scope may involve activities such as:
-
aerial inspection;
-
construction monitoring;
-
land or engineering surveys;
-
mapping and GIS services;
-
plantation and agricultural applications;
-
telecommunications inspection;
-
infrastructure monitoring;
-
industrial asset inspection; or
-
commercial aerial imaging.
The important question is whether the organization has established a controlled approach to its commercial UAS activities and can provide objective evidence that the system is being implemented.
Why ISO 21384-3:2026 Matters to Malaysian UAS Operators
ISO 21384-3:2026 is the third edition of the standard and replaced the previous 2023 edition.
The standard addresses commercial UAS operations across different applications and operating conditions. Its approach considers factors such as aircraft characteristics, operation type, operating environment and risks to third parties.
That matters for Malaysian operators because a drone program can become difficult to control when every project is handled differently.
Consider an engineering company that initially uses one drone and one pilot for occasional site inspections. A few years later, it has several aircraft, multiple pilots and projects in different states. Without a defined operating system, procedures can start to vary between teams.
One project may have a detailed risk assessment while another relies on an informal discussion. Maintenance records may be handled differently by different teams. Emergency procedures may exist but not be consistently communicated.
ISO 21384 provides a framework for bringing these activities under a more consistent operational system.
ISO 21384 Certification and CAAM Requirements in Malaysia
An organization considering ISO 21384 certification needs to manage two different areas.
The first is its operational management system. This is where ISO 21384 certification is relevant.
The second is aviation regulatory compliance. This includes the requirements applicable to the organization's UAS activities in Malaysia.
CAAM states that UAS activities are subject to the Civil Aviation Regulations and Civil Aviation Directives. Depending on the operation, different authorization routes may apply.
For example, CAAM provides guidance concerning Standard Authorisation to Fly, agricultural UAS operations and Special UAS Projects.
An ISO certificate does not replace these approvals.
Instead, a well-managed UAS organization should have a process for identifying the regulatory requirements applicable to each project and ensuring that the necessary approvals are addressed before the operation takes place.
This distinction is particularly important when ISO 21384 certification is mentioned in a tender or customer requirement. Certification demonstrates conformity with an applicable standard; it should not be presented as an aviation permit.
What Do Malaysian UAS Operators Need to Consider?
The regulatory requirements depend on the proposed operation.
CAAM guidance addresses matters such as UAS categories, operational conditions, authorization, flight limitations and application requirements. Certain activities can involve additional considerations depending on where and how the aircraft will be operated.
For an ISO 21384-certified organization, the practical issue is how these requirements are incorporated into its own operating process.
Suppose a customer requests a drone inspection at an industrial facility. The company should have a method for reviewing the location, understanding the proposed operation, identifying applicable requirements, assessing risks, confirming personnel competence and establishing the controls needed before the flight.
That process is more useful than simply keeping a folder labelled “drone regulations.”
The organization should be able to demonstrate who checks requirements, when they are checked and what evidence is retained.
CAAM Authorisation to Fly and ISO 21384
CAAM's Standard Authorisation to Fly route applies to certain UAS operations subject to specified conditions.
CAAM guidance also identifies requirements concerning matters such as flight conditions, operational planning, personnel and risk assessment. Operators should use the current CAAM requirements applicable to their particular activity rather than relying on old drone guidance or informal interpretations.
For an organization preparing for ISO 21384 certification, the sensible approach is to connect the regulatory process with the operational management system.
For example, a controlled process could look like this:
-
Receive the customer or project requirement.
-
Define the proposed UAS activity.
-
Review the location and operating conditions.
-
Identify applicable regulatory requirements.
-
Complete the relevant risk assessment.
-
Confirm personnel competence and responsibilities.
-
Verify aircraft and equipment readiness.
-
Complete required flight planning.
-
Confirm applicable external authorization.
-
Conduct the operation under approved procedures.
-
Record relevant operational information.
-
Review incidents, deviations and lessons learned.
The exact process will vary from one organization to another. What matters for certification is that the process is appropriate, implemented and supported by evidence.
Special UAS Projects in Malaysia
Not every commercial UAS operation fits the same operating model.
Some projects can involve unusual operational conditions, higher risks, research activities or other characteristics requiring specific regulatory consideration.
CAAM provides a Special UAS Project route for applicable activities.
From an ISO 21384 perspective, organizations involved in these projects should be able to show that their procedures reflect the actual risks of the operation.
A procedure designed for routine visual-line-of-sight inspection work may not be sufficient for a substantially different mission.
The organization should consider the operating environment, personnel, aircraft, communications, emergency arrangements, risk controls and other relevant factors when developing the operational plan.
Agricultural UAS Operations and ISO 21384 in Malaysia
Agriculture and plantation companies are among the Malaysian businesses that can use UAS for commercial purposes.
Applications may include crop monitoring, field assessment, imaging and other forms of agricultural data collection. Where spraying or dispensing is involved, additional requirements may apply.
ISO 21384 certification does not provide authorization for agricultural drone operations.
Its value is in helping the organization establish a controlled operating framework. This can include planning procedures, competence requirements, equipment checks, risk assessment, emergency arrangements and operational records.
A plantation company operating across several sites may particularly benefit from having a common procedure while allowing each site to receive its own operational risk assessment.
Other Malaysian Requirements That May Affect UAS Operations
CAAM is not necessarily the only authority relevant to every UAS project.
Depending on the nature of the activity, organizations may need to consider requirements associated with areas such as mapping, aerial photography, communications, protected locations, security-sensitive sites or other government requirements.
The applicable requirements depend on the project.
This is why a good ISO 21384 system should include a method for identifying applicable external requirements rather than attempting to turn the standard into a comprehensive Malaysian drone-law manual.
For example, a surveying company should consider the requirements relevant to its specific surveying or mapping work. A company operating near a sensitive location may need to address additional restrictions that would not apply to a routine industrial inspection elsewhere.
Key ISO 21384 Requirements for Malaysian UAS Operations
Operational Planning
Commercial UAS activities should be planned before the aircraft leaves the ground.
The planning process can cover the purpose of the operation, location, aircraft, personnel, environmental conditions, operational restrictions, potential hazards and emergency arrangements.
The depth of planning should reflect the operation.
A short inspection at a controlled industrial site may require a different level of planning from a large survey involving several aircraft, multiple teams and changing field conditions.
UAS Risk Assessment
Risk assessment should be specific enough to influence operational decisions.
Potential hazards can include people on the ground, other aircraft, structures, weather, terrain, communications problems, battery failure, navigation issues and unexpected access to the operating area.
A useful assessment identifies the hazard, considers the potential consequence and establishes appropriate controls.
A template copied from an earlier project may be convenient, but it should not replace an actual assessment of the current operation.
Personnel Competence
UAS operations involve more people than the remote pilot alone.
Depending on the organization, responsibilities may include remote pilots, visual observers, project managers, fleet managers, technical staff and other personnel.
The organization should define the competence required for relevant responsibilities and maintain appropriate evidence.
Training records are useful, but competence should be considered in relation to the actual work being performed.
Aircraft and Equipment Control
Aircraft and supporting equipment should be identifiable and appropriately controlled.
This can include maintenance information, battery records, inspection records, equipment configuration, payloads, communication systems and defect reporting.
A company managing several aircraft should be able to determine which aircraft is available, whether it has been inspected and whether known defects have been addressed.
Flight Preparation
Pre-flight preparation should be controlled through a practical process.
Depending on the operation, this may include aircraft condition, batteries, payload, communications, navigation, weather, operating area, personnel and emergency arrangements.
A checklist can be useful, provided it reflects the organization's actual operation rather than becoming paperwork that nobody uses.
Emergency and Abnormal Situations
UAS procedures should address reasonably foreseeable abnormal situations.
Examples include loss of communication, battery problems, unexpected weather, aircraft malfunction, navigation problems, loss of control or an unexpected person entering the operating area.
Personnel should understand the response expected from them and who has authority to make operational decisions.
Incident and Near-Miss Management
A commercial UAS program should learn from operational events.
A near miss can reveal a weakness before it develops into a more serious incident. The organization should therefore have a mechanism for reporting relevant events, investigating them and determining whether corrective action is necessary.
Over time, this provides management with a more useful picture of operational performance than simply counting completed flights.
What Does an ISO 21384 Audit in Malaysia Examine?
An ISO 21384 audit is not simply an inspection of the company's drones.
The auditor evaluates the organization's management and operational controls within the agreed certification scope.
Depending on the scope, audit evidence can include:
-
UAS operational procedures;
-
risk assessments;
-
competence and training records;
-
aircraft and equipment records;
-
flight planning documents;
-
inspection and maintenance records;
-
emergency procedures;
-
incident and near-miss reports;
-
corrective-action records;
-
internal audit results; and
-
management review or performance information.
The auditor may also compare documented procedures with what personnel actually do.
That difference matters. An organization can have an impressive manual and still have weak implementation if operational records do not support it.
ISO 21384 Internal Audit Checklist for Malaysia
Before the certification audit, a company can use an internal audit to ask practical questions.
Scope and responsibilities
Does the certification scope accurately describe the commercial UAS activities?
Are responsibilities clearly assigned?
Do personnel understand their responsibilities?
Operational controls
Are UAS operations planned before execution?
Are project-specific risks assessed?
Are applicable external requirements identified?
Are required approvals checked before operations?
Personnel
Are competence requirements defined?
Are relevant training and competence records available?
Equipment
Are aircraft and associated equipment identified?
Are inspections and maintenance controlled?
Are defects recorded and addressed?
Performance
Are incidents and near misses reported?
Are corrective actions followed through?
Are internal audits conducted?
Are operational results reviewed by appropriate management?
This type of review can reveal practical weaknesses before the certification audit.
ISO 21384 Certification in Kuala Lumpur
Kuala Lumpur organizations may use UAS for engineering, construction, infrastructure inspection, commercial imaging, telecommunications and property-related activities.
Operations in a densely developed environment can require careful consideration of buildings, people, traffic, infrastructure and the surrounding operating environment.
For certification purposes, the location itself is not the scope. The scope should describe the organization's commercial UAS activities and the locations to which the system applies.
ISO 21384 Certification in Selangor
Selangor's industrial, commercial, construction, logistics and technology sectors provide numerous potential applications for UAS.
Companies conducting inspections or surveys across several project locations should consider how operational controls remain consistent when different teams are involved.
A centralized procedure combined with project-specific risk assessments can be more practical than maintaining completely different systems for every site.
ISO 21384 Certification in Penang
Penang's manufacturing and technology sectors create applications for UAS in facility inspection, construction, infrastructure and asset monitoring.
Organizations working with industrial customers may also encounter customer-specific requirements concerning safety, access, documentation and contractor management.
These requirements can be incorporated into the organization's operational planning process where applicable.
ISO 21384 Certification in Johor
Johor has substantial industrial, logistics, construction and infrastructure activity.
UAS may be used for site surveys, inspection, project monitoring and asset-related work.
Organizations with multiple teams should pay attention to consistency. A customer should not receive one level of operational control simply because one project team has stronger procedures than another.
ISO 21384 Certification in Melaka
Commercial UAS applications in Melaka can involve manufacturing, construction, agriculture, property development and infrastructure work.
For companies working across different types of projects, the certification system should be flexible enough to accommodate different operational risks without losing control of the basic process.
ISO 21384 Certification in Perak
UAS applications in Perak can include surveying, plantation work, construction, industrial inspection and infrastructure activities.
Projects involving larger or more remote operating areas may require particular attention to communications, emergency arrangements, equipment readiness and site-specific risk assessment.
ISO 21384 Certification in Sabah
Sabah-based organizations can use UAS for commercial activities such as surveying, plantation operations, infrastructure work, construction and inspection.
Where projects involve particular locations or activities, the organization should identify the applicable Malaysian and local requirements before the operation.
ISO certification remains focused on the organization's operational system. It should not be described as authorization to conduct a specific flight.
ISO 21384 Certification in Sarawak
Sarawak's geography and industries create applications for UAS in infrastructure, energy, plantation, construction and surveying.
Organizations working across remote or widely separated locations may find documented procedures especially useful for maintaining consistent operational controls.
Regional requirements should be reviewed separately wherever they apply.
ISO 21384 Certification in Putrajaya
Companies working on infrastructure, government-related projects, technology activities or commercial assignments in Putrajaya should consider location-specific operational restrictions during project planning.
The organization's ISO 21384 system can provide a structured method for reviewing these requirements, but any external permission remains a separate matter.
ISO 21384 Certification in Cyberjaya
Cyberjaya's technology-oriented business environment creates potential applications for UAS in infrastructure inspection, surveying, engineering and technology projects.
For growing UAS businesses, ISO 21384 can help formalize operating procedures before the company expands its fleet or project portfolio.
Industries That Can Use ISO 21384 in Malaysia
Oil and Gas
UAS can support inspection, surveying and monitoring activities in oil and gas environments.
Because industrial sites can contain significant hazards, organizations should make sure that UAS procedures fit the site's broader safety and access controls.
Construction and Engineering
Construction companies can use drones for site surveys, progress documentation, inspection and project monitoring.
Where multiple projects are being managed simultaneously, standardized operational procedures can help maintain consistency.
Plantation and Agriculture
Plantation businesses can use UAS for field monitoring, crop assessment and other commercial applications.
Operations involving spraying or dispensing require separate consideration of applicable regulatory requirements.
Manufacturing
Manufacturers may use UAS for roof inspection, facility monitoring, infrastructure checks and other controlled applications.
The organization should establish clear criteria for when UAS operations are permitted and how they are managed.
Telecommunications
Telecommunications contractors can use UAS for tower and infrastructure inspection.
Planning should take account of the operating environment, personnel, equipment and applicable external requirements.
Surveying, Mapping and GIS
UAS can support mapping, photogrammetry, surveying and data-collection activities.
Where additional professional or regulatory requirements apply to the specific service, these should be managed separately from ISO certification.
Utilities and Infrastructure
Power, water, transport and infrastructure organizations can use UAS for asset inspections and condition monitoring.
A structured operating system can be particularly useful when inspections cover large numbers of assets.
Logistics and Warehousing
UAS may be used for selected inspection, facility monitoring and inventory-related applications.
Where drones operate around employees, vehicles or other equipment, operational boundaries should be clearly defined.
Real Estate and Property Development
Developers and property companies can use UAS for site documentation, progress monitoring, surveying and commercial imagery.
Project-specific risk assessment remains important, particularly where operations occur around occupied properties or the public.
Media and Commercial Photography
Media and photography businesses using UAS commercially should control flight preparation, equipment, personnel, operational restrictions and data handling.
Creative work does not remove the need for disciplined operational procedures.
UAS Data and Personal Data Protection in Malaysia
Drone operations can generate photographs, video, location information and other data.
Where personal data is collected or processed in circumstances covered by Malaysian data-protection requirements, the organization should consider its responsibilities under the Personal Data Protection Act 2010 and applicable guidance.
This becomes particularly relevant when imagery can identify individuals or when UAS data is combined with other information.
A sensible organization should know what information it collects, why it collects it, who can access it and how it is retained.
ISO 21384 should not be presented as a privacy-management certification. Where privacy is a significant business concern, the organization may need separate privacy controls or a dedicated privacy management framework.
Who Should Consider ISO 21384 Certification in Malaysia?
ISO 21384 may be relevant to organizations where commercial UAS operations form part of their business model.
This can include drone service companies, engineering firms, surveyors, construction companies, plantation businesses, telecommunications contractors, infrastructure operators, inspection companies, mapping providers, property developers and media organizations.
Owning a drone is not, by itself, the reason to pursue certification.
The stronger business case exists where UAS operations are recurring, customer-facing, operationally complex or subject to formal customer and tender expectations.
ISO 21384 and Malaysian Tender Requirements
Certification can become commercially relevant when a customer or tender specification specifically asks for ISO 21384 certification.
The wording of the tender should always be checked carefully.
For example, a tender may specify:
-
a particular ISO standard or edition;
-
a defined certification scope;
-
requirements for the certification body;
-
pilot or personnel qualifications;
-
aviation approvals;
-
insurance;
-
technical documentation; or
-
other contractor requirements.
An ISO certificate should therefore be viewed as one part of the organization's qualification package where the procurement documents require it.
It should not be assumed that certification automatically satisfies every technical or regulatory condition in a tender.
How Much Does ISO 21384 Certification Cost in Malaysia?
There is no universal ISO 21384 certification price.
The quotation can vary according to the size and complexity of the organization, number of personnel, number of locations, certification scope, operational activities and audit requirements.
A company operating one defined UAS service from one location may have a very different audit requirement from a large organization managing several aircraft, operational teams and project locations.
For an accurate quotation, the certification body normally needs enough information to understand the proposed scope and organizational structure.
How Long Does ISO 21384 Certification Take in Malaysia?
The certification timeline depends largely on organizational readiness and scope.
A company that already has documented procedures, competent personnel, risk assessments and operational records is in a different position from a business that is creating its UAS management system for the first time.
Preparation normally involves defining the scope, reviewing existing practices, addressing gaps, implementing procedures, conducting an internal audit and resolving identified issues before the certification audit.
The actual audit schedule should be determined after reviewing the organization's scope and readiness.
How to Prepare for ISO 21384 Certification in Malaysia
Start with the way the company actually operates.
Map the UAS activities from the initial customer request through planning, authorization, preparation, flight execution and post-operation review.
Then ask where control can be improved.
The organization should consider its:
-
UAS fleet;
-
operating locations;
-
personnel and responsibilities;
-
competence requirements;
-
operational procedures;
-
risk assessments;
-
maintenance arrangements;
-
emergency procedures;
-
incident reporting;
-
applicable regulatory requirements; and
-
customer or tender requirements.
The resulting management system should be usable by the people performing the work.
There is little benefit in producing a lengthy manual that does not reflect what happens in the field.
ISO 21384 Certification With SCS in Malaysia
SCS can work with organizations seeking ISO 21384 certification by reviewing the proposed certification scope and assessing the organization's conformity against the applicable requirements.
The discussion should begin with the business rather than a generic checklist.
A company providing drone surveys will have different operational considerations from a telecommunications contractor or plantation operator. Understanding those differences helps establish a certification scope that accurately reflects the organization.
The certification process can involve:
Scope discussion
The organization's UAS activities, locations and certification objectives are reviewed.
Readiness review
Existing procedures, records and operational controls are considered to identify areas requiring attention.
Certification audit
The certification body assesses the implemented system against the applicable requirements.
Corrective action
Where nonconformities are identified, the organization addresses them through appropriate corrective action.
Certification decision
Certification proceeds in accordance with the applicable certification process once the relevant conformity requirements have been addressed.
The precise arrangements depend on the organization's scope and certification requirements.
Why ISO 21384 Can Be Valuable for Malaysian UAS Businesses
A UAS operation often begins with equipment and technical expertise. As the business grows, management becomes more complicated.
More customers mean more projects. More projects mean different sites, different hazards and more people involved in planning and execution.
At that point, informal controls become difficult to maintain.
ISO 21384 can give the organization a structured way to manage those activities. It can help bring together operational planning, competence, equipment control, risk management, emergency response and performance review within a defined system.
For customers evaluating a UAS contractor, documented and independently assessed operational controls can also provide useful evidence of how the organization manages its work.
The value, however, comes from implementation rather than the certificate alone.
ISO 21384 Certification vs CAAM Authorization in Malaysia
The difference can be summarized simply.
ISO 21384 certification assesses whether an organization's applicable commercial UAS operational system conforms to the relevant requirements of the standard.
CAAM authorization concerns permission and regulatory compliance for applicable UAS operations in Malaysian airspace.
Other approvals may apply depending on the location, activity, data collected or other characteristics of a particular project.
Therefore, an ISO 21384 certificate should never be described as a replacement for CAAM authorization.
A responsible UAS company should manage both sides: its operational management system and its external regulatory obligations.
Get ISO 21384 Certified in Malaysia With SCS
If your company operates commercial UAS for surveying, inspection, construction, agriculture, infrastructure, telecommunications, engineering, mapping or other business activities, ISO 21384 certification can provide an independently assessed framework for managing those operations.
SCS can discuss your intended certification scope, existing procedures and readiness for ISO 21384 certification in Malaysia.
CAAM authorization and other Malaysian regulatory approvals remain separate from the ISO certification process, and the applicable requirements should be addressed for each operation.
Get Certified with SCS
Need ISO Certification for Your Business?
Speak with our certification specialists to understand certification requirements, audit process, implementation timelines and accredited certification services.
